CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a TLS...

CVE-2024-1052

Boundary and Boundary Enterprise are affected by CVE-2024-1052: session hijacking via TLS certificate tampering. The issue occurs when an attacker who can enumerate active/pending sessions, obtain a session private key, and possess a valid TOFU token can craft a TLS certificate to hijack an activ...

Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering

Summary Boundary and Boundary Enterprise “Boundary” is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use TOFU token may craft a...

IBM Tivoli Application Dependency Discovery Manager HTTP Header Injection Vulnerability

IBM Tivoli Application Dependency Discovery Manager TADDM is a product in the suite of IT service management solutions from International Business Machines IBM. The product provides robust automated application mapping and discovery to help administrators understand the structure, state,...

PT-2024-18732 · Samsung · Galaxy Store

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.63.6 Description: The issue allows local attackers to access sensitive information via implicit intent due to an implicit intent hijacking vulnerability in the In-App Purchase IAP component of the Galaxy...

PT-2024-18717 · Samsung · Smart Suggestions

Name of the Vulnerable Software and Affected Versions: Samsung mobile devices versions prior to SMR Feb-2024 Release 1 Description: The issue allows local attackers to get sensitive information due to an implicit intent hijacking vulnerability in Smart Suggestions. Recommendations: For versions...

PT-2024-18730 · Samsung · Galaxy Store

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.63.6 Description: The issue allows local attackers to access sensitive information via implicit intent. This is due to an implicit intent hijacking vulnerability in the SamsungAccount component of the Galaxy...

HashiCorp Boundary Security Vulnerability

HashiCorp Boundary is an open source solution from the US-based HashiCorp Inc. It automates secure identity-based user access to hosts and services across environments. A security vulnerability exists in HashiCorp Boundary and Boundary Enterprise versions prior to 0.15.0 that stems from...

Sumatra PDF 3.5.2 DLL Hijacking

Exploit Title: Sumatra PDF 3.5.2 DLL Hijacking Date: 06.02.2024 Exploit Author: Ravishanka Silva Vendor Homepage: https://www.sumatrapdfreader.org/free-pdf-reader Software Link: https://www.sumatrapdfreader.org/download-free-pdf-viewer Version: 3.5.2 Tested on: Windows 10, Windows 11 CVE :...

Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account

The decentralized social network Mastodon has disclosed a critical security flaw that enables malicious actors to impersonate and take over any account. "Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account," the maintainers said in a...

PT-2024-13077 · Reprise · Reprise License Manager

Name of the Vulnerable Software and Affected Versions: Reprise License Manager version 15.1 Description: The issue allows read-only users to arbitrarily change the password of an admin and hijack their account due to incorrect access control in Reprise License Management Software. Recommendations...

CVE-2023-43183

Incorrect access control in Reprise License Management Software Reprise License Manager v15.1 allows read-only users to arbitrarily change the password of an admin and hijack their account...

CVE-2023-47143

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting,...

CVE-2023-47143

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting,...

Cross site scripting

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting,...

CVE-2023-47143 IBM Tivoli Application Dependency Discovery Manager HOST header injection

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting,...

CVE-2023-47143 IBM Tivoli Application Dependency Discovery Manager HOST header injection

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting,...

CVE-2023-50938

CVE-2023-50938 – IBM PowerSC clickjacking : Affects PowerSC 1.3, 2.0, and 2.1. A remote attacker could hijack the victim’s clicking actions by compelling them to visit a malicious Web site, potentially enabling further attacks. The issue is explicitly documented in IBM’s PowerSC security bulletin...